Posted in GRC
Hackers set blood plasma freezers to 110°C. The weak point was a supplier. Over the night of 1–2 November…
Kätlin K. — Chief Partnership Officer
Hackers set blood plasma freezers to 110°C. The weak point was a supplier.
Over the night of 1–2 November, attackers changed temperature setpoints on refrigeration equipment used by France’s blood service (EFS), from around −30°C to 110°C. They didn’t go through EFS directly. They went through its cooling maintenance provider, Coolworld. Frozen plasma meant for transfusions was among the stored products.
What stopped it wasn’t a security tool. An on-call technician saw temperatures rising and teams acted before operations were affected.
Our take at Cyberr:
🔹 Your suppliers’ remote access is your attack surface. Healthcare organisations fall under NIS2, which makes supply chain security an explicit obligation, not a nice-to-have.
🔹 Cyber risk in healthcare is no longer just about patient records. Freezers, HVAC and building controllers protect medical supplies, and many are still reachable from the internet. CERT-FR warned about compromised refrigeration controllers just weeks ago.
🔹 People are the last line of defence. Independent monitoring and trained staff made the difference here.
🔹 The skills gap is real. Professionals who understand both IT and operational technology are among the hardest profiles to find, and demand is only growing.
When did you last review who can remotely access your critical equipment?
#Cybersecurity #OTSecurity #Healthcare #NIS2 #SupplyChainSecurity #Cyberr
🔗 https://cybersecuritynews.com/french-blood-plasma-freezers-hacked/
6 reactions · 2 comments
Topics: #cyberr, #nis2, #otsecurity, #supplychainsecurity, #cybersecurity, #healthcare
Comments
Victor Font: Kätlin, this illustrates why third-party risk management must extend beyond contracts and security questionnaires. Supplier access to critical operational systems requires defined ownership, restricted privileges, independent monitoring, and tested intervention procedures. The technician's response reportedly prevented disruption, but governance should ensure that protection doesn't depend on some
Kätlin K.: Absolutely agree, Victor Font . Effective third-party risk management must be proactive rather than reactive. Clear accountability, least-privilege access, continuous monitoring, and regularly tested response procedures are essential. Equally important is ensuring that these controls are embedded in everyday operations, not just documented in policies. Ultimately, resilience is demonstrated not by